{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Topics Discussed","type":"text","marks":[{"type":"strong"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"4"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"42fa6bad-3055-4972-8e0c-aca6551ad153"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"340f05ad-7fb9-4b20-8eea-c070469b0f5c"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Product Overview","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"The File Integrity Monitoring (FIM) service provides collection, analysis, and notification of changes to critical operating system files, as defined by Armor's FIM policy. Armor utilizes an enterprise-class FIM application and deploys the application agent with the Armor Agent. Armor is responsible for the configuration of the FIM services via remote agent. Configuration includes the application and maintenance of the policies associated with the service. Configuration specific to the local Host or network/environment to enable the service is a Customer responsibility. Armor is responsible for the administration of the FIM service through the Armor Agent. For the purposes of this section, \"administration\" is defined as the management of licenses and the application used to provide the service and the administration of the underlying FIM platform.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":700,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1920,"alt":"fim.mp4","id":"3803f2a3-7b40-4a32-bcdb-98f5a392f223","collection":"contentId-3519583476","type":"file","height":1080}}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"When traditional firewalls or intrusion detection systems (IDS) fail to prevent or detect a threat, monitoring operating system (OS) and application changes at the host level provides an additional layer of detection for indicators of compromise (IOC) or a breach of your environment. Security teams are largely in the dark to an attacker's presence, activities, and movements without monitoring processes and applications at the host level. Armor FIM watches your hosts 24/7/365 for anomalous and unauthorized activities to detect potential threats. It monitors critical system file locations on your hosts as well as critical OS files for changes that may allow threat actors to control your environment.","type":"text"},{"type":"hardBreak"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"To fully use this screen, you must add the following permission to your account:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read FIM","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enable Trend Sub-Agent","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"As a prerequisite to installing File Integrity Monitoring, you must install the Trend sub-agent. Use the following commands to manage the Trend sub-agent.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"For cloned assets with the Trend sub-agent installed, users will still need to enable the modules and run recommendation scans as needed.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"You can also manage the Trend sub-agent in the ","type":"text"},{"text":"Armor Toolbox.","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519582058"}}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Recommendation Scans","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"One of the features available in Agent 3.0 is Recommendation scans. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Recommendation scans provide a good starting point for establishing a list of rules that you should implement. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#696969"}}]},{"text":"During a recommendation scan, the Armor Agent scans the operating system for installed applications, the Windows registry, open ports, and more. To take advantage of Recommendation scans, turn on Ongoing Recommendation scans in the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Toolbox","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519582058"}}]},{"text":". ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Recommendation Scans work in tandem with the Auto-Apply configuration for FIM. The results of the Recommendation Scan can only be applied when Auto-Apply for the FIM service is turned on.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The commands below can be scheduled as tasks within the ","type":"text"},{"text":"Armor Toolbox","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519582058"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Install Trend Sub-Agent:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend install\nLinux: /opt/armor/armor trend install","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Uninstall Trend Sub-Agent:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend uninstall\nLinux: /opt/armor/armor trend uninstall ","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Trend Sub-Agent Status:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend status\nLinux: /opt/armor/armor trend status","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Turn On Recommended Scans:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend ongoing-recommendation-scan on\nLinux: /opt/armor/armor trend ongoing-recommendation-scan on","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Turn Off Recommended Scans:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend ongoing-recommendation-scan off\nLinux: /opt/armor/armor trend ongoing-recommendation-scan off","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Schedule a Recommended Scan (Runs on Next Trend Sub-Agent Heartbeat):","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend recommendation-scan\nLinux: /opt/armor/armor trend recommendation-scan","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Set Recommendation Scan Interval:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend set-recommendation-scan-interval \nLinux: /opt/armor/armor set-recommendation-scan-interval ","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":" Options are \"24 Hours\" \"2 Days\" \"3 Days\" \"7 Days\" \"2 Weeks\" \"3 Weeks\" \"4 Weeks\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Get Recommendation Scan Interval:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend get-recommendation-scan-interval\nLinux: /opt/armor/armor trend get-recommendation-scan-interval","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Trend Sub-Agent Help","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend help\nLinux: /opt/armor/armor trend help","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Restart Trend:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe trend service-restart\nLinux: /opt/armor/armor trend service-restart","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Enable File Integrity Monitoring Service","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Use the following commands to manage the File Integrity Monitoring service. These commands can be scheduled as tasks within the ","type":"text"},{"text":"Armor Toolbox","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519582058"}}]},{"text":".","type":"text"},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"Turn On File Integrity Monitoring:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim on\nLinux: /opt/armor/armor fim on\n\nOptional Parameters\nWindows: C:\\.armor\\opt\\armor.exe fim on auto-apply-recommendations=on\nLinux: /opt/armor/armor fim on auto-apply-recommendations=on\n\nWindows: C:\\.armor\\opt\\armor.exe fim on auto-apply-recommendations=off\nLinux: /opt/armor/armor fim on auto-apply-recommendations=off","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The Auto-Apply configuration for FIM works in tandem with Recommendation Scans. Only after a Recommendation Scan is run will there be policies to Auto-Apply.","type":"text"}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Turn Off File Integrity Monitoring:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim off\nLinux: /opt/armor/armor fim off","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"File Integrity Monitoring Status:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim status\nLinux: /opt/armor/armor fim status","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"List of Assigned FIM Rules on Policy:","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim list-assigned-rules\nLinux: /opt/armor/armor fim list-assigned-rules","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Assign FIM Rules: ","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim assign-rules ID\nLinux: /opt/armor/armor fim assign-rules ID","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Un-Assign FIM Rule: ","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim unassign-rule ID\nLinux: /opt/armor/armor fim unassign-rule ID","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"File Integrity Monitoring Help","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim help\nLinux: /opt/armor/armor fim help","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Add Custom Filepath Rule","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim add-custom-filepath-rule \",,\"\nLinux: /opt/armor/armor fim add-custom-filepath-rule \",,\"","type":"text"}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Once a rule is added, you must run the ","type":"text"},{"text":"Assign FIM Rules ","type":"text","marks":[{"type":"strong"}]},{"text":"command in order for the rule to be applied.","type":"text"}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Update Custom Filepath Rule","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim update-custom-filepath-rule \",,,\"\nLinux: /opt/armor/armor fim update-custom-filepath-rule \",,,\"","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Delete Custom Filepath Rule","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim delete-custom-filepath-rule \"\"\nLinux: /opt/armor/armor fim delete-custom-filepath-rule \"\"","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Get Custom Filepath Rule","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"Windows: C:\\.armor\\opt\\armor.exe fim get-custom-filepath-rule \"\"\nLinux: /opt/armor/armor fim get-custom-filepath-rule \"\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"View FIM Data","type":"text"}]},{"type":"rule"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), in the left-side navigation, click ","type":"text"},{"text":"Security","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"File Integrity Monitoring","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"full-width","width":760.0,"localId":"8223ebaa-06d1-433e-bdb1-071c2b971f2d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Column","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[645.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[645.0]},"content":[{"type":"paragraph","content":[{"text":"For Armor Enterprise Cloud, the name of the virtual machine you created in AMP.","type":"text"}]},{"type":"paragraph","content":[{"text":"For Armor Anywhere, the name of the instance that contains the installed Anywhere agent, which includes the FIM sub-agent.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Provider","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[645.0]},"content":[{"type":"paragraph","content":[{"text":"For Armor Enterprise Cloud, the entry will display ","type":"text"},{"text":"Armor","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"For Armor Anywhere, the name of the public cloud provider for the instance.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Status","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[645.0]},"content":[{"type":"paragraph","content":[{"text":"The health status of the sub-agent, which is based on how long the FIM sub-agent has been offline.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are three status types:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Secured (in green)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Warning (in yellow)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Critical (in red)","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Connectivity","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[645.0]},"content":[{"type":"paragraph","content":[{"text":"The connection status of the sub-agent.","type":"text"}]},{"type":"paragraph","content":[{"text":"There are three connection types:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Online","type":"text","marks":[{"type":"strong"}]},{"text":" indicates that the sub-agent is online.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Offline","type":"text","marks":[{"type":"strong"}]},{"text":" indicates that the sub-agent is currently offline.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Needs","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Attention","type":"text","marks":[{"type":"strong"}]},{"text":" indicates that the sub-agent has not communicated with Armor.","type":"text"}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[115.0]},"content":[{"type":"paragraph","content":[{"text":"Timestamp","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[645.0]},"content":[{"type":"paragraph","content":[{"text":"The date and time that the FIM sub-agent last communicated with Armor.","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"To learn how the overall FIM status is determined, see ","type":"text"},{"text":"Understand FIM data","type":"text","marks":[{"type":"link","attrs":{"href":"#FileIntegrityMonitoring-UnderstandFIMdata"}}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Understand FIM Data","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"File Integrity Monitoring ","type":"text","marks":[{"type":"strong"}]},{"text":"screen, the dashboard displays the various FIM statuses of your virtual machines (or hosts):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Green","type":"text","marks":[{"type":"strong"}]},{"text":" indicates a virtual machine in a ","type":"text"},{"text":"Secured","type":"text","marks":[{"type":"strong"}]},{"text":" FIM status.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Yellow","type":"text","marks":[{"type":"strong"}]},{"text":" indicates a virtual machine in a ","type":"text"},{"text":"Warning","type":"text","marks":[{"type":"strong"}]},{"text":" FIM status. ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Red","type":"text","marks":[{"type":"strong"}]},{"text":" indicates a virtual machine in a ","type":"text"},{"text":"Critical","type":"text","marks":[{"type":"strong"}]},{"text":" FIM status.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Armor determines the status of ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":" based on how long ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":" has been offline.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":" is offline for 2 to 7 days, then the ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":" status changes from ","type":"text"},{"text":"Secured","type":"text","marks":[{"type":"strong"}]},{"text":" to ","type":"text"},{"text":"Warning","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":" is offline for 8 days or more, then the ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":" status changes from ","type":"text"},{"text":"Warning","type":"text","marks":[{"type":"strong"}]},{"text":" to ","type":"text"},{"text":"Critical","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"},{"type":"hardBreak"}]}]}]},{"type":"table","attrs":{"layout":"default","width":430.0,"localId":"a6342cc4-045e-4a77-9ee3-bde4cc98c265"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Length of offline status","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Security Status","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"2 to 7 days","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Warning","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"8 days or more","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Critical","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"The overall status of your virtual machine is based on the individual status of your virtual machine's subcomponents, including ","type":"text"},{"text":"FIM","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"View Detailed FIM Data","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"File Integrity Monitoring ","type":"text","marks":[{"type":"strong"}]},{"text":"details","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"screen displays the changes that has been detected in certain files in your virtual machine. This screen only shows data for the last 90 days. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), in the left-side navigation, click ","type":"text"},{"text":"Security","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"File Integrity Monitoring","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Locate and select the desired virtual machine.","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":750.0,"localId":"c1ab9123-ab39-4d65-8f2f-ee02f3f6a84a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Column","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[581.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Filename","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[581.0]},"content":[{"type":"paragraph","content":[{"text":"The name of the file where a change was detected.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[581.0]},"content":[{"type":"paragraph","content":[{"text":"A short summary of the change that took place.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Change Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[581.0]},"content":[{"type":"paragraph","content":[{"text":"The type of change that took place in the file.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[169.0]},"content":[{"type":"paragraph","content":[{"text":"Scan Date","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[581.0]},"content":[{"type":"paragraph","content":[{"text":"The date when the change was detected.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Export FIM Data","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"To export the data: ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), in the left-side navigation, click ","type":"text"},{"text":"Security","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"File Integrity Monitoring.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) Use the filter function to customize the data displayed.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Below the table, click ","type":"text"},{"text":"CSV","type":"text","marks":[{"type":"strong"}]},{"text":". You have the option to export all the data (","type":"text"},{"text":"All","type":"text","marks":[{"type":"strong"}]},{"text":") or only the data that appears on the current screen (","type":"text"},{"text":"Current Set","type":"text","marks":[{"type":"strong"}]},{"text":").","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default","width":970.0,"localId":"c02f3306-7125-49d3-a54d-6b4a2530b7ae"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#eeeeee","rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"FUNCTION","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#eeeeee","rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"DATA DISPLAYED","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#eeeeee","rowspan":1,"colwidth":[323.0]},"content":[{"type":"paragraph","content":[{"text":"NOTES","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[113.0]},"content":[{"type":"paragraph","content":[{"text":"CSV","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[533.0]},"content":[{"type":"paragraph","content":[{"text":"VM Name, VM Provider, IP Address, OS, FIM Agent Status Fixed, FIM Agent Version, FIM Last Communication Date","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[323.0]},"content":[{"type":"paragraph","content":[{"text":"A blank entry indicates that the action has never taken place.","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Troubleshooting","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor troubleshoots servers that contain ","type":"text"},{"text":"File Integrity Monitoring ","type":"text","marks":[{"type":"strong"}]},{"text":"sub-components in a ","type":"text"},{"text":"Warning","type":"text","marks":[{"type":"strong"}]},{"text":" or ","type":"text"},{"text":"Critical","type":"text","marks":[{"type":"strong"}]},{"text":" status. To troubleshoot with Armor, you must submit a support ticket.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), click ","type":"text"},{"text":"Support,","type":"text","marks":[{"type":"strong"}]},{"text":" and then click ","type":"text"},{"text":"Tickets","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create a Ticket","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select or search for the desired category for your ticket request type.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Complete the missing fields.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Description","type":"text","marks":[{"type":"strong"}]},{"text":", enter useful details that can help Armor quickly troubleshoot the problem.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To view the status of your ticket, in the left-side navigation, click ","type":"text"},{"text":"Support","type":"text","marks":[{"type":"strong"}]},{"text":", and then click ","type":"text"},{"text":"Tickets","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Log Search for File Integrity Monitoring","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Users can search for FIM events in Log Search. For instructions on how to access and use Log Search, please see our documentation ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519580060"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"An example of FIM logs can be seen below:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":900,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":883,"id":"33a73447-8507-48df-b6d2-fadd32eddbac","collection":"contentId-3519583476","type":"file","height":464}}]},{"type":"paragraph","content":[{"text":"For a full list of Log Search fields and descriptions, please visit our glossary ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519580060"}}]},{"text":". ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Frequently Asked Questions","type":"text"}]},{"type":"rule"},{"type":"table","attrs":{"layout":"full-width","width":760.0,"localId":"ac718706-e793-490d-9d9f-aa94c8e672dd"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"What kind of activity does File Integrity Monitoring look for?","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[532.0]},"content":[{"type":"paragraph","content":[{"text":"Changes to critical OS file sand processes such as directories, registry keys, and values. It also watches for changes to application files, rogue applications running on the host, and unusual process and port activity and system incompatibilities.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[228.0]},"content":[{"type":"paragraph","content":[{"text":"What happens with events that are detected by File Integrity Monitoring?","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[532.0]},"content":[{"type":"paragraph","content":[{"text":"Events are analyzed and correlated with event data from your other devices under Armor management through our threat prevention and response platform, delivering enhanced detection of potential threats across your cloud, on-premise, hybrid, and hosted environments.","type":"text"}]}]}]}]},{"type":"paragraph"},{"type":"paragraph"}],"version":1}